Privacy Policy

Pholio Studio, Inc. ("Pholio," "we," "our," or "us") operates the platform accessible at www.pholio.studio and app.pholio.studio (collectively, the "Platform"). We are the data controller responsible for your personal data.

For all privacy-related questions, requests, or concerns, please contact our Privacy Team at:

Email: privacy@pholio.studio

Mailing address: Pholio Studio, Inc., [Your Address], [City, State, ZIP], United States

If you are located in the European Economic Area (EEA) or the United Kingdom, you also have the right to lodge a complaint with your local supervisory authority. We encourage you to contact us first so we can address your concern directly.

This Privacy Policy applies to all personal data we collect when you: (a) visit our marketing website at www.pholio.studio; (b) create and use an account on our application at app.pholio.studio; (c) interact with us by email, social media, or any other channel; or (d) apply to or manage talent as an agency partner.

This Policy does not apply to third-party websites, services, or applications that may be linked from our Platform. We encourage you to review the privacy policies of any third parties before providing them with personal data.

If you are a talent user ("Talent"), this Policy explains how we handle your portfolio data, images, professional profile, and the casting analysis we generate to help agencies discover you. If you are an agency user ("Agency"), this Policy explains how we handle your roster management, team accounts, and business data. Some sections apply to both user types; where distinctions exist, we note them clearly.

We collect personal data only when necessary for legitimate business purposes. Below is a full account of the categories of data we collect, the source of that data, and the purpose for which we use it.

If you are located in the EEA or UK, we rely on the following legal bases under the General Data Protection Regulation (GDPR) and UK GDPR:

Performance of a Contract (Art. 6(1)(b)): Processing necessary to provide you with the Platform and its features — account creation, portfolio management, automated casting analysis and discovery, agency matching, and subscription management.

Legitimate Interests (Art. 6(1)(f)): Processing necessary for our legitimate business interests, including platform security, fraud prevention, location verification, product improvement, and analytics — where those interests are not overridden by your rights.

Consent (Art. 6(1)(a)): Processing of special category profile data and any optional communications such as marketing emails. You may withdraw consent at any time without affecting the lawfulness of prior processing.

Legal Obligation (Art. 6(1)(c)): Processing required for compliance with applicable law, such as financial recordkeeping for tax purposes and verification of parental or guardian consent for minors.

Where we process special categories of data — such as ethnicity/heritage, physical measurements, or appearance attributes derived from photo analysis, which may indirectly reveal racial or ethnic origin or health-related information — we rely on your explicit consent (Art. 9(2)(a) GDPR). You provide such data voluntarily as part of your professional profile; it is not mandatory.

We do not sell your personal data. We share personal data only in the circumstances described below.

Pholio is based in the United States. If you access the Platform from outside the United States, your data may be transferred to, stored in, and processed in the United States or other countries where our service providers operate.

For users in the EEA, UK, or Switzerland, we implement appropriate safeguards for international transfers in accordance with GDPR Chapter V, including Standard Contractual Clauses (SCCs) approved by the European Commission where applicable. A copy of our transfer mechanisms is available upon request at privacy@pholio.studio.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements.

Account Data: Retained for the duration of your account and for up to 3 years after account deletion, unless a longer retention period is required by law.

Portfolio Images and Media: Stored on Cloudflare R2 and deleted within 30 days of account deletion or upon your request, except where we are required to retain them for legal or dispute-resolution purposes.

AI-Derived Data and Search Embeddings: Casting assessments and the embeddings used for discovery are retained while your profile is active and re-generated when your profile changes; they are deleted alongside your profile data on account deletion.

Payment Records: Retained for 7 years in accordance with tax and financial recordkeeping obligations.

Application Records: Retained for 2 years after the conclusion of an application process.

Analytics Data: Aggregated analytics may be retained indefinitely as they do not identify individuals. Raw logs containing IP addresses are purged after 90 days.

Session Data: Active sessions expire after 30 days of inactivity. Expired session records are purged monthly.

Support Communications: Retained for 3 years from last contact to allow follow-up and resolve recurring issues.

You may request early deletion of your data at any time (see Section 8, Your Rights).

We implement technical and organizational security measures proportionate to the sensitivity of the data we hold. These measures include:

Despite these measures, no system is completely immune to security risks. If you suspect unauthorized access to your account, please contact us immediately at privacy@pholio.studio. In the event of a data breach that affects your rights and freedoms, we will notify you and relevant authorities in accordance with applicable law (within 72 hours for GDPR-covered incidents).

Depending on where you reside, you have rights regarding your personal data. We honor these rights for all users regardless of location, to the extent technically feasible. Many of these can be exercised directly in your account settings, which include data export and erasure requests, account deactivation, portfolio visibility controls, the ability to block specific agencies, and contact, cookie, and notification preferences.

Right of Access: You may request a copy of the personal data we hold about you, along with information about how and why we process it.

Right to Rectification: You may request that we correct inaccurate or incomplete personal data. Most profile data can be updated directly in your account settings.

Right to Erasure ("Right to Be Forgotten"): You may request deletion of your personal data. We will delete your data subject to applicable retention obligations (e.g., financial records we must keep by law).

Right to Restriction: You may request that we limit how we process your data, for example while a dispute is being resolved.

Right to Data Portability: You may request an export of your personal data in a structured, commonly used, machine-readable format (JSON or CSV).

Right to Object: You may object to processing based on legitimate interests, including profiling. We will cease such processing unless we can demonstrate compelling legitimate grounds.

Right to Withdraw Consent: Where processing is based on consent (e.g., special category profile data, marketing emails), you may withdraw consent at any time without penalty.

Right to Non-Discrimination (CCPA): California residents have the right not to be discriminated against for exercising their privacy rights. We will not deny services, charge different prices, or provide a lower quality of service based on the exercise of these rights.

Right to Opt-Out of Sale: We do not sell personal data as defined under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). No opt-out mechanism is required, but if our practices change, we will update this Policy and provide an opt-out link.

To exercise any of these rights, submit a request to privacy@pholio.studio with the subject line "Privacy Rights Request." We will verify your identity before processing the request and respond within 30 days (extendable by an additional 60 days for complex requests, with notice). We do not charge a fee for reasonable requests.

We use cookies and similar technologies to operate the Platform. The table below describes the cookies we set.

Strictly Necessary Cookies: These are required for the Platform to function and cannot be disabled. They include session authentication cookies (to keep you logged in), CSRF protection tokens, and security-related identifiers. Legal basis: Legitimate interests / Legal obligation.

Preference Cookies: These store your preferences such as display settings and onboarding state, so you do not need to reconfigure them on each visit. Legal basis: Legitimate interests.

Analytics Cookies (First-Party): We use server-side analytics to track aggregated page views and feature usage. We do not use Google Analytics, Facebook Pixel, or other third-party tracking scripts on the authenticated application. Legal basis: Legitimate interests.

No Advertising Cookies: We do not use cookies for advertising, retargeting, or cross-site behavioral tracking.

Cookie Controls: Authenticated users can manage analytics and marketing preferences in their account settings. You can also control cookies through your browser settings. Disabling strictly necessary cookies will prevent you from logging in or using core Platform features. Disabling preference cookies will cause your preferences to reset on each visit.

Pholio supports professional talent who may be minors (for example, child models), but accounts for minors must be created and managed by a parent or legal guardian. Where a Talent's date of birth indicates they are under 18, we treat the profile as a minor profile and apply additional safeguards: we require a recorded parent or guardian consent before sensitive measurement data is collected or the portfolio is made publicly visible, and we may record whether a work permit is on file.

General-audience accounts are not directed to children below the minimum age required for data processing in their jurisdiction (16 in much of the EEA, or 13 in the United States where COPPA applies). We do not knowingly collect personal data from such children without verifiable parental or guardian consent.

If you are a parent or guardian and believe your child has created a Pholio account or provided us with personal data without your consent, please contact us immediately at privacy@pholio.studio. We will investigate and, if confirmed, delete the account and all associated data promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Platform features. When we make material changes, we will:

For non-material changes (such as grammatical corrections or clarifications that do not alter the substance of the Policy), we will update the date and publish the revised Policy without separate notification. Your continued use of the Platform after the effective date of a revised Policy constitutes your acceptance of the updated terms.

We maintain a version history of this Policy, which is available upon request at privacy@pholio.studio.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights in addition to those described in Section 8:

Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collection, and the categories of third parties with whom it was shared.

Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g., completing a transaction, security purposes, legal compliance).

Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.

Right to Opt-Out of Sale or Sharing: We do not sell personal information or share it for cross-context behavioral advertising as defined under the CCPA/CPRA.

Right to Limit Use of Sensitive Personal Information: We process sensitive personal information (such as physical measurements, ethnicity/heritage, and appearance attributes derived from photo analysis) to provide and operate the casting, portfolio, and discovery services you request. We do not use sensitive personal information to infer characteristics for purposes unrelated to delivering these services, and we do not sell or share it.

Shine the Light: California Civil Code Section 1798.83 permits California residents to request information about our disclosure of personal data to third parties for direct marketing purposes. We do not disclose personal data to third parties for their own direct marketing purposes.

To submit a verifiable California consumer request, email privacy@pholio.studio with "California Privacy Rights Request" in the subject line. We will acknowledge receipt within 10 business days and respond substantively within 45 days (extendable by an additional 45 days with notice).

If you are located in the European Economic Area or the United Kingdom, the following additional information applies:

Data Controller: Pholio Studio, Inc. is the data controller for personal data processed through the Platform.

EU/UK Representative: [If applicable — If you do not have an EU/UK establishment, you should appoint an Art. 27 representative. Placeholder: Our EU/UK representative can be contacted at privacy@pholio.studio pending formal appointment.]

Supervisory Authority Complaints: You have the right to lodge a complaint with the supervisory authority in your EU member state or the UK Information Commissioner's Office (ICO) if you believe we have processed your data unlawfully. However, we would appreciate the opportunity to address your concern directly first.

Automated Processing: We use automated photo and profile analysis to generate casting assessments and to rank and surface talent in agency search. This processing supports human decision-making by agencies and Pholio; we do not make solely automated decisions that produce legal or similarly significant effects on you. You may request human review of, or object to, this processing by contacting us.

Legitimate Interests Assessment: Where we rely on legitimate interests as a legal basis, we have conducted a balancing test to ensure our interests do not override your fundamental rights and freedoms. Details of these assessments are available upon request.